Protecting sensitive data in a security area

ABSTRACT

Managing data security on a mobile device. Data associated with a mobile device is received; the data includes an identification (ID) of the mobile device and a location of the mobile device relative to one or more location sensor devices. A path is determined, relative to the one or more location sensor devices, through which the mobile device has travelled. An electronic security key is communicated to the mobile device based on determining that the path corresponds to a defined path associated with the mobile device.

BACKGROUND

Embodiments of the invention generally relate to data security, and moreparticularly to software security on mobile devices.

As mobile devices gain wider use in personal and enterprise settings,the risk of improper dissemination of confidential informationincreases. Currently, mobile devices to lack effective local dataprotection measures.

SUMMARY

An embodiment of the invention provides a method for managing datasecurity on a mobile device. The method receives data associated with amobile device; the data includes an identification (ID) of the mobiledevice and a location of the mobile device relative to one or morelocation sensor devices. The method determines a path, relative to theone or more location sensor devices, through which the mobile device hastravelled, and communicates an electronic security key to the mobiledevice based on determining that the path corresponds to a defined pathassociated with the mobile device.

A further embodiment of the invention provides a computer system formanaging data security on a mobile device. The computer system includesa processor and a tangible non-transitory storage device. The storagedevice stores a program having instructions for execution by theprocessor. The instructions implement a method that receives dataassociated with a mobile device; the data includes an identification(ID) of the mobile device and a location of the mobile device relativeto one or more location sensor devices. The method determines a path,relative to the one or more location sensor devices, through which themobile device has travelled, and communicates an electronic security keyto the mobile device based on determining that the path corresponds to adefined path associated with the mobile device.

A further embodiment of the invention provides a computer programproduct for managing data security on a mobile device. The computeprogram product includes a non-transitory storage medium storing programcode, the program code including instructions for execution by aprocessor of a computer to implement a method. The method receives, bythe processor, data associated with a mobile device; the data includesan identification (ID) of the mobile device and a location of the mobiledevice relative to one or more location sensor devices. The methoddetermines, by the processor, a path, relative to the one or morelocation sensor devices, through which the mobile device has travelled,and communicates, by the processor, an electronic security key to themobile device based on determining that the path corresponds to adefined path associated with the mobile device.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

FIG. 1 is a block diagram of a system for managing data security on amobile device, according to an aspect of the invention.

FIG. 2 is a flowchart of a method of managing data security on a mobiledevice, according to an aspect of the invention.

FIG. 3 is a block diagram of an exemplary computer system/server,according to an aspect of the invention.

FIG. 4 a block diagram of a cloud computing environment, according to anaspect of the invention.

FIG. 5 is a block diagram of functional layers of the cloud computingenvironment of FIG. 4, according to an aspect of the invention.

DETAILED DESCRIPTION

FIG. 1 depicts a mobile security environment 100, according to anembodiment of the invention. Mobile security environment 100 includes aserver 104 containing a data security program 108, one or more locations112, and one or more location sensor 116 devices, having detection zones120. Mobile security environment 100 may further include one or both ofauthorized path 124 and unauthorized path 128. Each of these componentsis described in greater detail below.

Server 104 may be a computing device having a processor and a tangiblestorage device for storing data security program 108. Data securityprogram may include a set of instructions executable by the processor.Server 104 and data security program 108 generally may includefunctionality to manage mobile data security in mobile securityenvironment 100. Server 104 may be in close physical proximity to othercomponents of mobile security environment 100 (for example, to locationsensors 116), or may be remotely connected to them via, for example, acloud service, through connection 132 (connection 132 may include one ormore connectivity devices or systems such as, for example, WiFi andBluetooth, over networks such as LAN, WAN, or the Internet or a cloudcomputing environment).

Locations 112 may include, for example and without limitation, physicalland, buildings, rooms, hallways, floors, or other physical locations.Locations 112 may correspond to various locations associated withsecurity requirements. In one example, locations 112 may be rooms in abuilding where access and security are controlled. Locations 112 mayhave the same or different security needs. A user of a mobile device maytravel through one or more of locations 112 while carrying the mobiledevice. As the user travels through locations 112, the user may travelthrough one or more paths, including, for example, path 124 (denoted bya solid line) and path 128 (denoted by a dotted line). In oneembodiment, the user's path through locations 112 may correspond to anauthorized path or an unauthorized path. Whether the user has traveledthrough an authorized path may be tracked. Based on whether the user hastraveled through an authorized path, the user may be granted or deniedaccess to secured data on the mobile device. The user's access tosecured data may be revoked upon the user taking an exit path, or theuser leaving a location where the access was previously granted.

Mobile security environment may include one or more location sensors 116placed in or near locations 112 to detect the presence and movement of amobile device within one or more detection zones 120. Each locationsensor 116 may detect a mobile device within its respective detectionzone 120. Location sensors 116 may communicate with server 104 viaconnection 132 to notify server 104 of the mobile device's presence orabsence from respective detection zones 120. In one example, as shown inFIG. 1, location sensors 116 may be installed in respective locations112 and may include sensors S1, S2, and S3, each having a detection zoneZ1, Z2, and Z3, respectively. In this example, path 124 may be anauthorized path for a user (not shown) and may pass through Z1, Z2, andZ4. Path 128 may be an unauthorized path for the user and may passthrough Z1, Z2 and Z3.

Path 124 and path 128 are two travel paths along which a mobile devicemay be detected, according to an example described in greater detail inconnection with method 200 (FIG. 2), described below.

One or more mobile devices may be registered with server 104 asauthorized mobile devices. Authorized devices may be eligible forreceiving a security key to encrypt data to be stored on, or decryptdata already stored on, the authorized mobile device. In one embodiment,an authorized mobile device may receive a security key when it isdetermined the authorized mobile device is detected as being in asecured location, and when it is determined that the authorized mobiledevice has traveled through an authorized path to arrive at the securedlocation. In one embodiment, this may be the only scenario in which thesecurity key is communicated to the authorized mobile device.

FIG. 2 is a flowchart of a method 200 for managing data security on amobile device, according to an embodiment of the invention. Method 200may be implemented via one or more instructions in a computer program,such as data security program 108 (FIG. 1). A computer processor (forexample, a processor of server 104 in FIG. 1) may execute the computerprogram's instructions.

Referring now to FIGS. 1 and 2, location sensor S1 may detect a mobiledevice (not shown) entering detection zone Z1 and receive dataassociated with the mobile device (step 204). For example, S1 mayreceive the mobile device's identification (ID) information (such as anID code). S1 may communicate, and server 104 may receive, the ID andlocation information associated with the mobile device.

Server 104 may determine a path through which the mobile device hastravelled (step 208) by analyzing the information received from S1, aswell as any path data previously associated with the mobile device.Where there is no previous traveled path data associated with the mobiledevice, server 104 may create a corresponding record in its database.The record may be created to include the mobile device's ID and itscurrently detected location. In the example where the mobile devicetravels along authorized path 124, the record may be created to includethe following when the mobile device is first detected by S1 in Z1.

DEVICE_ID DEVICE_PATH 12345 Z1

A variety of additional data may be collected by S1, and optionally byone or more additional sensors. This additional data also may be addedto the record associated with the mobile device. It may include, forexample, time stamp, speed of travel, authorization status, number andmanner of deviations from an authorized path, and other information.

If a record already exists for the mobile device, server 104 may updatethe determined path associated with the mobile device based on newlyreceived data (step 212). For example, S1 may detect the mobile devicetravelling through Z1 and may communicate the information to server 104.Server 104 may receive the information (step 204) and create acorresponding record as described above (step 208). At some time afterS1 detects the mobile device entering Z1, S2 may detect the mobiledevice entering Z2 (S1 may also detect that the mobile device is nolonger in Z1, although this is not necessary). S2 may communicate thisinformation to server 104. Server 104 may receive this information (step204) and update the determined path for the mobile device based on theadditional information received from S2 (step 212).

Server 104 may periodically query records associated with the userdevice to determine whether the user device has remained in a givendetection zone 120 for longer than a defined threshold period withoutits location being updated (step 216). The threshold value may bedefined arbitrarily (for example, 30 seconds) or based on one or morefactors, such as the average time it takes to travel through aparticular location 112. The threshold value may be defined differentlyfor each location 112 and its corresponding detection zone 120. In oneexample, server 104 may receive data from S1 and S2 indicating that themobile device has travelled through Z1 and Z2. Server 104 may update themobile device's record to include “Z1->Z2” in the DEVICE_PATH field.Server 104 may additionally receive data from S4 that the mobile devicehas entered Z4, and may update the DEVICE_PATH field to “Z1->Z2->Z3”.After the threshold time elapses (for example, 30 seconds) withoutserver 104 receiving another update, server 104 may determine that themobile device is no longer travelling between detection zones 120, andthat it has remained in its last recorded detection zone 120, i.e., Z4.

Server 104 may analyze the mobile device's travelled path to determinewhether it corresponds to an authorized path associated with the mobiledevice, and may communicate an electronic security key to the mobiledevice upon a positive finding (step 220). If server 104 determines thatthe travel path is unauthorized, it may take no action (i.e., notcommunicate the security key to the mobile device), or it may generate asecurity alert (for example, it may communicate the generated securityalert to a system administrator). Server 104 may communicate the key tothe mobile device via any known method in the art, including, withoutlimitation, through one or more intermediary devices such as thelocation sensors 116. In one embodiment, server 104 may communicate thesecurity key to the mobile device via the location sensor 116 in thelast recorded detection zone 120 for the mobile device. This is one wayin which server 104 can prevent communication of the security key to themobile device if the mobile device exits the detection zone 120 beforeserver 104 receives data indicating that the mobile device has moved.Continuing with the above example where server 104 determines that themobile device has traveled along the path “Z1->Z2->Z4” and furtherdetermined that 30 seconds have elapsed since the mobile device lastmoved to a new detection zone 120, server 104 may compare the mobiledevice's traveled path to one or more authorized paths for the mobiledevice. For example, server's 104 database may include authorized path124, which is defined as “Z1->Z2->Z4”. In this example, server 104determines that the mobile device's traveled path “Z1->Z2->Z4” isidentical to authorized path 124. Server 104 may determine, therefore,that the mobile device is authentic and may communicate the security keyto the mobile device via location sensor S4.

In another example, server 104 may receive information indicating thatthe mobile device has traveled through unauthorized path 128, defined as“Z1->Z2->Z3”, and that the mobile device has not exited Z3 for 30seconds or more. Server 104 may compare unauthorized path 128 to itsdatabase of authorized paths for the mobile device, and may determinethat path 128 is an unauthorized path for the mobile device. Server 104may take no action (i.e., not send the security code to the mobiledevice). In addition, or alternatively, server 104 may generate andcommunicate an alert message to a system administrator.

Server 104 may determine, subsequent to communicating the security keyto the mobile device, that the mobile device has exited a last recordeddetection zone 120 subsequent to server 104 communicating the electronicsecurity key (step 224). The exit by the mobile device may be anindication that the mobile device is no longer in an authorized locationand should no longer have access to confidential data. Continuing withthe above example, where the mobile device travels along authorized path124 (“Z1->Z2->Z4”), server 104 may receive a communication from S4 thatthe mobile device is no longer within Z4. Alternatively, or in addition,server 104 may receive a communication from any of the other locationsensors 116 that the mobile device has moved into one or more of theirrespective detection zones 120. Server 104 may terminate the securitycode as a result of receiving this communication.

In various embodiments of the invention, the key communicated by server104 to the mobile device may a key for encrypting and/or decryptinginformation stored on or accessed by the mobile device. For example, themobile device may first receive the security key from server 104 toencrypt data on the mobile device at a time when the mobile device isauthenticated (for example, when server 104 has determined that themobile device has traveled along an authorized path). Thereafter, server104 may revoke the security key, and may reactivate it or issue a newsecurity key only after determining that the mobile device has returnedto a secure location and traveled along an authorized path to get there.

In various embodiments, the security key may be updated based on,relative to the mobile device, data corresponding to one or more ofspeed of movement, frequency of remaining stationary, and length of timeof remaining stationary.

Referring now to FIG. 4, a schematic of an example of a cloud computingnode is shown. Cloud computing node 10 is only one example of a suitablecloud computing node and is not intended to suggest any limitation as tothe scope of use or functionality of embodiments of the inventiondescribed herein. Regardless, cloud computing node 10 is capable ofbeing implemented and/or performing any of the functionality set forthhereinabove.

In cloud computing node 10 there is a computer system/server 12, whichis operational with numerous other general purpose or special purposecomputing system environments or configurations. Examples of well-knowncomputing systems, environments, and/or configurations that may besuitable for use with computer system/server 12 include, but are notlimited to, personal computer systems, server computer systems, thinclients, thick clients, hand-held or laptop devices, multiprocessorsystems, microprocessor-based systems, set top boxes, programmableconsumer electronics, network PCs, minicomputer systems, mainframecomputer systems, and distributed cloud computing environments thatinclude any of the above systems or devices, and the like.

Computer system/server 12 may be described in the general context ofcomputer system-executable instructions, such as program modules, beingexecuted by a computer system. Generally, program modules may includeroutines, programs, objects, components, logic, data structures, and soon that perform particular tasks or implement particular abstract datatypes. Computer system/server 12 may be practiced in distributed cloudcomputing environments where tasks are performed by remote processingdevices that are linked through a communications network. In adistributed cloud computing environment, program modules may be locatedin both local and remote computer system storage media including memorystorage devices.

As shown in FIG. 4, computer system/server 12 in cloud computing node 10is shown in the form of a general-purpose computing device. Thecomponents of computer system/server 12 may include, but are not limitedto, one or more processors or processing units 16, a system memory 28,and a bus 18 that couples various system components including systemmemory 28 to processor 16.

Bus 18 represents one or more of any of several types of bus structures,including a memory bus or memory controller, a peripheral bus, anaccelerated graphics port, and a processor or local bus using any of avariety of bus architectures. By way of example, and not limitation,such architectures include Industry Standard Architecture (ISA) bus,Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, VideoElectronics Standards Association (VESA) local bus, and PeripheralComponent Interconnects (PCI) bus.

Computer system/server 12 typically includes a variety of computersystem readable media. Such media may be any available media that isaccessible by computer system/server 12, and it includes both volatileand non-volatile media, removable and non-removable media.

System memory 28 can include computer system readable media in the formof volatile memory, such as random access memory (RAM) 30 and/or cachememory 32. Computer system/server 12 may further include otherremovable/non-removable, volatile/non-volatile computer system storagemedia. By way of example only, storage system 34 can be provided forreading from and writing to a non-removable, non-volatile magnetic media(not shown and typically called a “hard drive”). Although not shown, amagnetic disk drive for reading from and writing to a removable,non-volatile magnetic disk (e.g., a “floppy disk”), and an optical diskdrive for reading from or writing to a removable, non-volatile opticaldisk such as a CD-ROM, DVD-ROM or other optical media can be provided.In such instances, each can be connected to bus 18 by one or more datamedia interfaces. As will be further depicted and described below,memory 28 may include at least one program product having a set (e.g.,at least one) of program modules that are configured to carry out thefunctions of embodiments of the invention.

Program/utility 40, having a set (at least one) of program modules 42,may be stored in memory 28 by way of example, and not limitation, aswell as an operating system, one or more application programs, otherprogram modules, and program data. Each of the operating system, one ormore application programs, other program modules, and program data orsome combination thereof, may include an implementation of a networkingenvironment. Program modules 42 generally carry out the functions and/ormethodologies of embodiments of the invention as described herein.

Computer system/server 12 may also communicate with one or more externaldevices 14 such as a keyboard, a pointing device, a display 24, etc.;one or more devices that enable a user to interact with computersystem/server 12; and/or any devices (e.g., network card, modem, etc.)that enable computer system/server 12 to communicate with one or moreother computing devices. Such communication can occur via Input/Output(I/O) interfaces 22. Still yet, computer system/server 12 cancommunicate with one or more networks such as a local area network(LAN), a general wide area network (WAN), and/or a public network (e.g.,the Internet) via network adapter 20. As depicted, network adapter 20communicates with the other components of computer system/server 12 viabus 18. It should be understood that although not shown, other hardwareand/or software components could be used in conjunction with computersystem/server 12. Examples, include, but are not limited to: microcode,device drivers, redundant processing units, external disk drive arrays,RAID systems, tape drives, and data archival storage systems, etc.

Referring now to FIG. 5, illustrative cloud computing environment 50 isdepicted. As shown, cloud computing environment 50 comprises one or morecloud computing nodes 10 with which local computing devices used bycloud consumers, such as, for example, personal digital assistant (PDA)or cellular telephone 54A, desktop computer 54B, laptop computer 54C,and/or automobile computer system 54N may communicate. Nodes 10 maycommunicate with one another. They may be grouped (not shown) physicallyor virtually, in one or more networks, such as Private, Community,Public, or Hybrid clouds as described hereinabove, or a combinationthereof. This allows cloud computing environment 50 to offerinfrastructure, platforms and/or software as services for which a cloudconsumer does not need to maintain resources on a local computingdevice. It is understood that the types of computing devices 54A-N shownin FIG. 4 are intended to be illustrative only and that cloud computingnodes 10 and cloud computing environment 50 can communicate with anytype of computerized device over any type of network and/or networkaddressable connection (e.g., using a web browser).

Referring now to FIG. 5, a set of functional abstraction layers providedby cloud computing environment 50 (FIG. 4) is shown. It should beunderstood in advance that the components, layers, and functions shownin FIG. 5 are intended to be illustrative only and embodiments of theinvention are not limited thereto. As depicted, the following layers andcorresponding functions are provided:

Hardware and software layer 60 includes hardware and softwarecomponents. Examples of hardware components include: mainframes 61; RISC(Reduced Instruction Set Computer) architecture based servers 62;servers 63; blade servers 64; storage devices 65; and networks andnetworking components 66. In some embodiments, software componentsinclude network application server software 67 and database software 68.

Virtualization layer 70 provides an abstraction layer from which thefollowing examples of virtual entities may be provided: virtual servers71; virtual storage 72; virtual networks 73, including virtual privatenetworks; virtual applications and operating systems 74; and virtualclients 75.

In one example, management layer 80 may provide the functions describedbelow. Resource provisioning 81 provides dynamic procurement ofcomputing resources and other resources that are utilized to performtasks within the cloud computing environment. Metering and Pricing 82provide cost tracking as resources are utilized within the cloudcomputing environment, and billing or invoicing for consumption of theseresources. In one example, these resources may comprise applicationsoftware licenses. Security provides identity verification for cloudconsumers and tasks, as well as protection for data and other resources.User portal 83 provides access to the cloud computing environment forconsumers and system administrators. Service level management 84provides cloud computing resource allocation and management such thatrequired service levels are met. Service Level Agreement (SLA) planningand fulfillment 85 provide pre-arrangement for, and procurement of,cloud computing resources for which a future requirement is anticipatedin accordance with an SLA.

Workloads layer 90 provides examples of functionality for which thecloud computing environment may be utilized. Examples of workloads andfunctions which may be provided from this layer include: mapping andnavigation 91; software development and lifecycle management 92; virtualclassroom education delivery 93; data analytics processing 94;transaction processing 95; managing data security on a mobile device 96,including those described in connection with FIGS. 1-3.

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include a computerreadable storage medium (or media) having computer readable programinstructions thereon for causing a processor to carry out aspects of thepresent invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++ or the like, andconventional procedural programming languages, such as the “C”programming language or similar programming languages. The computerreadable program instructions may execute entirely on the user'scomputer, partly on the user's computer, as a stand-alone softwarepackage, partly on the user's computer and partly on a remote computeror entirely on the remote computer or server. In the latter scenario,the remote computer may be connected to the user's computer through anytype of network, including a local area network (LAN) or a wide areanetwork (WAN), or the connection may be made to an external computer(for example, through the Internet using an Internet Service Provider).In some embodiments, electronic circuitry including, for example,programmable logic circuitry, field-programmable gate arrays (FPGA), orprogrammable logic arrays (PLA) may execute the computer readableprogram instructions by utilizing state information of the computerreadable program instructions to personalize the electronic circuitry,in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

What is claimed is:
 1. A method for managing data security on a mobiledevice, comprising: receiving data associated with a mobile device, thedata comprising an identification (ID) of the mobile device and alocation of the mobile device relative to one or more location sensordevices; determining a path, relative to the one or more location sensordevices, through which the mobile device has travelled, wherein the oneor more location sensor devices define a plurality of detection zones,and wherein the path through which the mobile device has travelledrefers to a set of detection zones that the mobile device has travelledthrough as detected by the one or more location sensor devices;communicating an electronic security key to the mobile device based ondetermining that the path corresponds to a defined path associated withthe mobile device, wherein the defined path comprises a set of detectionzones through which the mobile device is authorized to travel, whereincommunicating the electronic security key to the mobile device isperformed after determining that a predefined length of time has passedsince last updating the determined path; and terminating the electronicsecurity key based on determining that the mobile device has exited alast recorded location subsequent to receiving the electronic securitykey.
 2. The method of claim 1, further comprising: updating thedetermined path based on receiving new data associated with the mobiledevice, the new data comprising the ID of the mobile device and a newlocation of the mobile device relative to the one or more locationsensor devices.
 3. The method of claim 1, further comprising: appendingan electronic record associated with the mobile device in an electronictable to include information comprising one or more of the ID of themobile device, the location of the mobile device, and a timestampassociated with the location of the mobile device.
 4. The method ofclaim 1, further comprising: updating the electronic key to include oneor both of the received data and new data associated with the mobiledevice, the new data comprising the ID of the mobile device and a newlocation of the mobile device relative to the one or more locationsensor devices.
 5. The method of claim 1, further comprising:invalidating the electronic key based on determining that the mobiledevice is not registered based on querying a registration database. 6.The method of claim 1, wherein the electronic security key is one orboth of: an encryption key, whereby the mobile device encrypts data,prior to storing the data on a storage device of the mobile device,using the electronic security key; and a decryption key, whereby themobile device decrypts data stored on a storage device of the mobiledevice using the electronic security key.
 7. The method of claim 1,wherein determining the path further comprises: receiving datacorresponding to, relative to the mobile device, one or more of speed ofmovement, frequency of remaining stationary, and length of time ofremaining stationary.
 8. A computer system for managing data security ona mobile device, comprising: a computer device having a processor and atangible storage device; and a program embodied on the storage devicefor execution by the processor, the program having a plurality ofprogram instructions comprising program instructions for: receiving dataassociated with a mobile device, the data comprising an identification(ID) of the mobile device and a location of the mobile device relativeto one or more location sensor devices; determining a path, relative tothe one or more location sensor devices, through which the mobile devicehas travelled, wherein the one or more location sensor devices define aplurality of detection zones, and wherein the path through which themobile device has travelled refers to a set of detection zones that themobile device has travelled through as detected by the one or morelocation sensor devices; communicating an electronic security key to themobile device based on determining that the path corresponds to adefined path associated with the mobile device, wherein the defined pathcomprises a set of detection zones through which the mobile device isauthorized to travel, wherein the program instructions for communicatingthe electronic security key to the mobile device are executed afterexecuting the program instructions for determining that a predefinedlength of time has passed since last updating the determined path; andterminating the electronic security key based on determining that themobile device has exited a last recorded location subsequent toreceiving the electronic security key.
 9. The computer system of claim8, wherein the program instructions further comprise instructions for:updating the determined path based on receiving new data associated withthe mobile device, the new data comprising the ID of the mobile deviceand a new location of the mobile device relative to the one or morelocation sensor devices.
 10. The computer system of claim 8, wherein theprogram instructions further comprise instructions for: appending anelectronic record associated with the mobile device in an electronictable to include information comprising one or more of the ID of themobile device, the location of the mobile device, and a timestampassociated with the location of the mobile device.
 11. The computersystem of claim 8, wherein the electronic security key is one or bothof: an encryption key, whereby the mobile device encrypts data, prior tostoring the data on a storage device of the mobile device, using theelectronic security key; and a decryption key, whereby the mobile devicedecrypts data stored on a storage device of the mobile device using theelectronic security key.
 12. The computer system of claim 8, wherein theprogram instructions further comprise instructions for: invalidating theelectronic key based on determining that the mobile device is notregistered based on querying a registration database.
 13. A computerprogram product for managing data security on a mobile device,comprising a non-transitory tangible storage device having program codeembodied therewith, the program code executable by a processor of acomputer to perform a method, the method comprising: receiving dataassociated with a mobile device, by the processor, the data comprisingan identification (ID) of the mobile device and a location of the mobiledevice relative to one or more location sensor devices; determining apath, by the processor, relative to the one or more location sensordevices, through which the mobile device has travelled, wherein the oneor more location sensor devices define a plurality of detection zones,and wherein the path through which the mobile device has travelledrefers to a set of detection zones that the mobile device has travelledthrough as detected by the one or more location sensor devices;communicating an electronic security key to the mobile device, by theprocessor, based on determining that the path corresponds to a definedpath associated with the mobile device, wherein the defined pathcomprises a set of detection zones through which the mobile device isauthorized to travel, wherein communicating the electronic security keyto the mobile device is performed, a predefined length of time haspassed since last updating the determined path; and terminating theelectronic security key based on determining that the mobile device hasexited a last recorded location subsequent to receiving the electronicsecurity key.
 14. The computer program product of claim 13, wherein themethod further comprises: updating the determined path, by theprocessor, based on receiving new data associated with the mobiledevice, the new data comprising the ID of the mobile device and a newlocation of the mobile device relative to the one or more locationsensor devices.
 15. The computer program product of claim 13, whereinthe method further comprises: appending an electronic record associatedwith the mobile device in an electronic table, by the processor, toinclude information comprising one or more of the ID of the mobiledevice, the location of the mobile device, and a timestamp associatedwith the location of the mobile device.
 16. The computer program productof claim 13, wherein the electronic security key is one or both of: anencryption key, whereby the mobile device encrypts data, prior tostoring the data on a storage device of the mobile device, using theelectronic security key; and a decryption key, whereby the mobile devicedecrypts data stored on a storage device of the mobile device using theelectronic security key.
 17. The computer program product of claim 13,wherein the method further comprises: invalidating the electronic key,by the processor, based on determining that the mobile device is notregistered based on querying a registration database.